GCVE-110-OSM-2026-12792

This repository distributes a malicious ZIP archive (attachments_보험청구서.zip) disguised as an insurance claim document. The archive contains a Windows LNK shortcut that executes a multi-stage PowerShell dropper which drops a persistence script via a scheduled task masquerading as OneDrive, then beacons to a remote C2 to download and execute a second-stage payload while exfiltrating the victim's username and domain. A decoy PDF is opened to distract the victim. Stage 1 Executes via conhost.exe --headless to hide the window. Runs hex-decoded PowerShell that: - Drops C:\Users\Public\ZxzHFwLRDx6Lxn1.ps1 - Registers scheduled task OneDriveUpdateMachineCoreUE (runs every 2 min, persists after reboot) - Opens decoy PDF from https://jiui9wf.yzz.me/ to distract victim Stage 2 Dropped PS1 calls: http://xv57j3d.scienceontheweb.net/setting.php?aaaaaa=<userdomain>&bfbfbff2=<username>&cccccc=alpha Exfiltrates $env:userdogalin (domain) and $env:username. Downloads next-stage PS1 to %APPDATA%\Microsoft\gertg4wf.ps1, executes it, then self-deletes.